I have some searches that do not appear to be enhancing properly using the asset_lookup_by_str lookup table.
In this case, I'll use dvc, but it appears to be similar with the others like dest as well.
I run a search, the enhancements don't seem to be happening.
If I run a search using the lookup it works sometimes. I'll give a few examples
Search 1:
index=windows
| lookup asset_lookup_by_str asset AS dvc OUTPUTNEW domain AS AAAAA
Result 1: I get AAAAA to have only 1 of our 5 domains
Search 2:
index=windows host=[hostname]
| lookup asset_lookup_by_str asset AS dvc OUTPUTNEW domain AS AAAAA
Result 2: AAAAA doesn't show up .
Search 3:
| inputlookup asset_lookup_by_str
Result 3: The lookup table appears to be filled in nicely. Including the domains missing from search 1.
Search 4:
| inputlookup asset_lookup_by_str
| search asset=[host]
Result 4: The host searched in Search 2 is in the lookup table.
Based on this, I'd say not only should Search 2 have worked, but Search 1 should have had more results, and the automatic lookup as a whole should be working.
Any ideas what could be happening? My only thought is maybe some sort of priority order that is overriding the enhancement feature. But that wouldn't explain it not working in the specific search.
